View Javadoc

1   package org.apache.turbine.util;
2   
3   /*
4    * Licensed to the Apache Software Foundation (ASF) under one
5    * or more contributor license agreements.  See the NOTICE file
6    * distributed with this work for additional information
7    * regarding copyright ownership.  The ASF licenses this file
8    * to you under the Apache License, Version 2.0 (the
9    * "License"); you may not use this file except in compliance
10   * with the License.  You may obtain a copy of the License at
11   *
12   *   http://www.apache.org/licenses/LICENSE-2.0
13   *
14   * Unless required by applicable law or agreed to in writing,
15   * software distributed under the License is distributed on an
16   * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
17   * KIND, either express or implied.  See the License for the
18   * specific language governing permissions and limitations
19   * under the License.
20   */
21  
22  import org.apache.ecs.Entities;
23  
24  import org.apache.ecs.filter.CharacterFilter;
25  
26  /***
27   * Some filter methods that have been orphaned in the Screen class.
28   *
29   *
30   * @author <a href="mailto:mbryson@mont.mindspring.com">Dave Bryson</a>
31   * @author <a href="mailto:hps@intermeta.de">Henning P. Schmiedehausen</a>
32   * @version $Id: InputFilterUtils.java 534527 2007-05-02 16:10:59Z tv $
33   */
34  
35  public abstract class InputFilterUtils
36  {
37      /*** A HtmlFilter Object for the normal input filter */
38      private static final CharacterFilter filter = htmlFilter();
39  
40      /*** A HtmlFilter Object for the minimal input filter */
41      private static final CharacterFilter minFilter = htmlMinFilter();
42  
43      /***
44       * This function can/should be used in any screen that will output
45       * User entered text.  This will help prevent users from entering
46       * html (<SCRIPT>) tags that will get executed by the browser.
47       *
48       * @param s The string to prepare.
49       * @return A string with the input already prepared.
50       */
51      public static String prepareText(String s)
52      {
53          return filter.process(s);
54      }
55  
56      /***
57       * This function can/should be used in any screen that will output
58       * User entered text.  This will help prevent users from entering
59       * html (<SCRIPT>) tags that will get executed by the browser.
60       *
61       * @param s The string to prepare.
62       * @return A string with the input already prepared.
63       */
64      public static String prepareTextMinimum(String s)
65      {
66          return minFilter.process(s);
67      }
68  
69      /***
70       * These attributes are supposed to be the default, but they are
71       * not, at least in ECS 1.2.  Include them all just to be safe.
72       *
73       * @return A CharacterFilter to do HTML filtering.
74       */
75      private static CharacterFilter htmlFilter()
76      {
77          CharacterFilter filter = new CharacterFilter();
78          filter.addAttribute("\"", Entities.QUOT);
79          filter.addAttribute("'", Entities.LSQUO);
80          filter.addAttribute("&", Entities.AMP);
81          filter.addAttribute("<", Entities.LT);
82          filter.addAttribute(">", Entities.GT);
83          return filter;
84      }
85  
86      /*
87       * We would like to filter user entered text that might be
88       * dynamically added, using javascript for example.  But we do not
89       * want to filter all the above chars, so we will just disallow
90       * <.
91       *
92       * @return A CharacterFilter to do minimal HTML filtering.
93       */
94      private static CharacterFilter htmlMinFilter()
95      {
96          CharacterFilter filter = new CharacterFilter();
97          filter.removeAttribute(">");
98          filter.removeAttribute("\"");
99          filter.removeAttribute("'");
100         filter.removeAttribute("&");
101         filter.addAttribute("<", Entities.LT);
102         return filter;
103     }
104 }